Overview

overview

6

Static

static

5

Network_To...it.exe

windows10-2004-x64

6

Network_To...it.exe

windows11-ltsc_2024-x64

6

Network_To...al.cmd

windows10-2004-x64

6

Network_To...al.cmd

windows11-ltsc_2024-x64

6

Network_To...ks.ps1

windows10-2004-x64

3

Network_To...ks.ps1

windows11-ltsc_2024-x64

3

Network_To...WS.cmd

windows10-2004-x64

3

Network_To...WS.cmd

windows11-ltsc_2024-x64

3

Network_To...al.cmd

windows10-2004-x64

3

Network_To...al.cmd

windows11-ltsc_2024-x64

3

Network_To...te.cmd

windows10-2004-x64

3

Network_To...te.cmd

windows11-ltsc_2024-x64

3

Network_To...ub.cmd

windows10-2004-x64

3

Network_To...ub.cmd

windows11-ltsc_2024-x64

3

Network_To...on.svg

windows10-2004-x64

3

Network_To...on.svg

windows11-ltsc_2024-x64

4

Network_To...ild.sh

ubuntu-18.04-amd64

3

Network_To...ild.sh

debian-9-armhf

3

Network_To...ild.sh

debian-9-mips

3

Network_To...ild.sh

debian-9-mipsel

3

Network_To...est.js

windows10-2004-x64

3

Network_To...est.js

windows11-ltsc_2024-x64

3

Network_To..._v2.js

windows10-2004-x64

3

Network_To..._v2.js

windows11-ltsc_2024-x64

3

Network_To...rag.js

windows10-2004-x64

3

Network_To...rag.js

windows11-ltsc_2024-x64

3

Network_To...est.js

windows10-2004-x64

3

Network_To...est.js

windows11-ltsc_2024-x64

3

Network_To...ews.js

windows10-2004-x64

6

Network_To...ews.js

windows11-ltsc_2024-x64

6

Network_To...ns.ps1

windows10-2004-x64

3

Network_To...ns.ps1

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Network_Toolkit_1.17.149_Portable.zip
  • Size 13.8MB
  • Sample261102-jm698aat2n
  • SHA256 c9ecf2f1fea02d27638c243295886a317543ac3e3867a2118aa4e09d067b1819
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoveryexecutionjavascriptlinuxspywaresvgtrojan

Malware Config

Targets

    • Target
      Network_Toolkit_1.17.149/Network_Toolkit.exe
    • Size 20.1MB
    • SHA256 327ae7b8c0c51e3b6688c50ccddbdaf9ac7273fcf389f145942009f63f14cf7d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverytrojan

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1behavioral2
    • Target
      Network_Toolkit_1.17.149/Open_Terminal.cmd
    • Size 108B
    • SHA256 ea8bb5b759998d781315696a3cdcba0d5bb23a70ce6765e5b0e65a915d2be5b6
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discoveryexecution

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral3behavioral4
    • Target
      Network_Toolkit_1.17.149/source/.github/workflows/checks.yml
    • Size 70KB
    • SHA256 8710dbba90927b990921ffb5a5d80874d473255bd4b3630c80d5013dcba75a76
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      Network_Toolkit_1.17.149/source/BUILD_WINDOWS.cmd
    • Size 563B
    • SHA256 1b20f1d7060c4de138414450edc8078e00071bd63dc3dc650060b1aa3d62dce1
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral7behavioral8
    • Target
      Network_Toolkit_1.17.149/source/Open_Terminal.cmd
    • Size 96B
    • SHA256 8a0a527aac96dfadc03ecf8dcdfd7bc93b04d52e18a2414250e428d4602fcd14
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      Network_Toolkit_1.17.149/source/Publish_Update.cmd
    • Size 301B
    • SHA256 9f2d78bbac2bdc8563cd4b154dff3393058396325366548996ae4c7d3e4f1f98
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      Network_Toolkit_1.17.149/source/Setup_GitHub.cmd
    • Size 355B
    • SHA256 016e754d468130e9be181938c55270cc203458da0a0f766a6f42faa8c374f3c4
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      Network_Toolkit_1.17.149/source/assets/Network_Toolkit_Icon.svg
    • Size 1KB
    • SHA256 7a8a7259f11d30a01c27875e6afb1ac89d0b720c29079e3235f1027f7aa50ae6
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral15behavioral16
    • Target
      Network_Toolkit_1.17.149/source/build.sh
    • Size 249B
    • SHA256 ff61c1a0763046c5828767ba79c76cb8c5779e32dfde6fa3b681c2f89d58b476
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18behavioral19behavioral20
    • Target
      Network_Toolkit_1.17.149/source/cmd/network-toolkit/credential_security_windows_test.go
    • Size 7KB
    • SHA256 023559f655964c9b01f08d74bb6a6bd5bb08537746cd4781f2bc150ad29696a7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      Network_Toolkit_1.17.149/source/cmd/network-toolkit/credential_vault_v2.go
    • Size 24KB
    • SHA256 3d717fd47f33e8009e754882cbb3df13944295053c031ce636889b5b747bce39
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      Network_Toolkit_1.17.149/source/cmd/network-toolkit/editor_drag.go
    • Size 7KB
    • SHA256 6e9555fd4e3e2e2104af7c6f4c7732ed268d8d5428855fe041cb2f962a465443
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral25behavioral26
    • Target
      Network_Toolkit_1.17.149/source/cmd/network-toolkit/editor_memory_test.go
    • Size 3KB
    • SHA256 2eb305862506877b7c7b4eaa619e53feea273eab8ed5f9ec805f30a4e039a9af
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral27behavioral28
    • Target
      Network_Toolkit_1.17.149/source/cmd/network-toolkit/editor_views.go
    • Size 31KB
    • SHA256 f5b5c3f6665657762eb08be7ed80d1d0b4e70c5ce545941c59d5d09f6b07bf0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral29behavioral30
    • Target
      Network_Toolkit_1.17.149/source/cmd/network-toolkit/local_network_actions.go
    • Size 14KB
    • SHA256 c2cac30c0ff76512f0f2c8eec755c63c938d21fc65a0a083dcf2dab6fbda4a2b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

svgjavascript
Score
5/10

behavioral1

defense_evasiondiscoverytrojan
Score
6/10

behavioral2

defense_evasiondiscoverytrojan
Score
6/10

behavioral3

discoveryexecution
Score
6/10

behavioral4

discoveryexecution
Score
6/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

adwarediscoveryspyware
Score
3/10

behavioral16

adwarediscoveryspyware
Score
4/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

discovery
Score
6/10

behavioral30

discovery
Score
6/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10